Critical Red Hat Keycloak Flaw (CVE-2024-1137) Lets Attackers Take Over User Accounts

Key Takeaways

• A critical vulnerability (CVE-2026-18963) has been discovered in Red Hat Build of Keycloak.
• This flaw allows unauthenticated attackers to bypass email verification in the password recovery process, enabling full account takeover.
• The vulnerability affects the core identity and access management engine, impacting confidentiality and integrity with a CVSS v3.1 score of 9.1.
• Red Hat has released patches, and immediate application is strongly recommended.

Critical Flaw in Red Hat Keycloak Enables Account Takeovers

Red Hat has disclosed a severe security vulnerability within its Red Hat Build of Keycloak, an open-source identity and access management solution. This critical flaw, identified as CVE-2026-18963, could allow remote, unauthenticated attackers to compromise and fully take over arbitrary user accounts. The vulnerability, which resides in the password recovery mechanism, has been assigned a CVSS v3.1 score of 9.1, indicating its high severity.

Understanding the Vulnerability

The core of the issue lies within the reset-credentials flow of the keycloak-services component, which is central to Keycloak’s identity and access management functionalities. This particular vulnerability permits an attacker to initiate a password reset for any target account and subsequently bypass the essential email verification step designed to authorize such recovery requests.

Crucially, successful exploitation does not require the attacker to possess valid credentials, have prior access to a Keycloak realm, or elicit any interaction from the targeted user. By exploiting this flawed recovery process, an attacker can set new credentials for a chosen account, thereby gaining complete control over it.

Public disclosure of this issue occurred on August 17, 2026, with Red Hat updating its advisory on August 20. The company classified the flaw as “Critical” due to its remote exploitability over a network, low attack complexity, lack of required privileges, and absence of user interaction. The CVSS vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, highlights a high impact on both confidentiality and integrity. A successful attacker could access information and perform actions with the permissions of the compromised user.

In environments where Keycloak manages high-privilege accounts, such as those for administrators, developers, or critical services, the compromise of a single identity could lead to widespread unauthorized access across interconnected applications and services.

Red Hat has categorized CVE-2026-18963 under CWE-640, which pertains to improper password recovery mechanisms. The root cause is identified as inadequate state validation within the reset-credentials authentication flow. A properly secured recovery process should mandate that a user completes the required email-based verification before allowing credential changes; the vulnerable flow fails to adequately enforce this critical condition.

Patching and Mitigation

Red Hat has released fixes for this vulnerability through several security errata published on August 18. These fixed packages include Red Hat builds of Keycloak 26.4 and 26.6 release streams, as well as updated keycloak-services packages in versions 26.4.15 and 26.6.6.

Relevant fixes are available via RHSA-2026:56519, RHSA-2026:56520, RHSA-2026:56523, and RHSA-2026:56524. Organizations are urged to identify all deployments of Red Hat Build of Keycloak, encompassing standalone instances, operator-managed installations, and OpenShift deployments.

What You Should Do

• Apply Patches Immediately: Administrators must apply the appropriate Red Hat errata and update to a fixed version as soon as possible.
• Disable “Forgot Password” (If Immediate Patching is Not Possible): As a temporary workaround, Red Hat advises disabling the “Forgot password” feature across all realms. This can be done in the Keycloak administration console by navigating to Realm settings, selecting Login, and setting “Forgot password” to “Off.”
• Monitor Logs: Security teams should review password-reset logs, account credential changes, unusual administrative logins, and authentication events involving privileged accounts. Any unexpected password reset activity should be investigated promptly as a potential account takeover attempt.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.